Response to the consultation on
Draft Statutory Instrument
On
The Companies (Disclosure of Address) Regulations 2008
For any queries please contact
Mrs Gillian Key-Vice
Director of Regulatory Affairs
Experian
Landmark House
Experian Way
NG2 Business Park
Nottingham NG80 1ZZ
Tel: 0115828 6242
Mobile: 07967 342 666
Email
Background
About Experian
Experian is a global leader in providing information, analytical and marketing services to organisations and consumers to help manage the risk and reward of commercial and financial decisions.
Combining its unique information tools and deep understanding of individuals, markets and economies, Experian partners with organisations around the world to establish and strengthen customer relationships and provide their businesses with competitive advantage.
For consumers, Experian delivers critical information that enables them to make financial and purchasing decisions with greater control and confidence.
Clients include organisations from financial services, retail and catalogue, telecommunications, utilities, media, insurance, automotive, leisure, e-commerce, manufacturing, property and government sectors.
Experian Group Limited is listed on the London Stock Exchange (EXPN) and is a constituent of the FTSE 100 index. It has corporate headquarters in Dublin, Ireland, and operational headquarters in Costa Mesa, California and Nottingham, UK. Experian employs around 15,500 people in 36 countries worldwide, supporting clients in more than 65 countries. Annual sales are in excess of $3.8 billion (£1.9 billion/€2.8 billion).
For more information, visit the Group's website on
The word 'Experian' is a registered trademark in the EU and other countries and is owned by Experian Ltd and/or its associated companies.
Experian is the largest credit reference agency (‘CRA’) out of the 3 consumer credit reference agencies operating in the UK[1], supplying c70% of the shared personal data used for credit underwriting by the UK financial sector. This amounts to some 150m credit enquiries each year. Experian also provides data for a variety of other purposes such as credit account management, identification checks for the prevention of money laundering as required under the Prevention of Money Laundering Regulations. Under Regulation 114 of the Representation of the People (England & Wales) Regulations 2001, the CRAs are the only non-public organisations entitled by law to hold the full Register.
The response to the consultation
Why credit reference agencies need access to this data
Experian welcomes the publication of the draft Regulations and is fully supportive of the need to control access to the home addresses of individuals who might be, or think they might be, at risk.
At the same time, it is important that in seeking to protect individuals from the unwelcome and, in some cases, dangerous attentions of others, that the normal process of application for financial services should not be jeopardised.
Credit reference agencies provide reliable and consistent data, from a variety of sources, that enables lenders to make robust and effective decisions about whether to provide, or continue to provide credit to individuals or businesses[2]. That data enables lenders to quickly and accurately perform checks such as those on the proprietors[3] required for the prevention of fraud and money laundering as well as to check the creditworthiness of the applicant organisation.
Access to the home addresses of the proprietors is a vital part of those checks as it enables lenders to
- Verify the identity of the proprietors and/or beneficial shareholders
- Carry out checks to ensure that the proprietors are not disqualified
- Check on other directorships or businesses
- Check the personal creditworthiness of the proprietors of small businesses
Key to performing such checks is the usual home address of the proprietor being the common domiciliation of such information. Some checks will be performed to verify information already provided by the data subject themselves and some as part of a fully automated check initiated by a credit check on the company which in turn pulls data on the company and the proprietors to deliver a credit score based on the totality of the information.
Discussions on this issue and the need for credit reference agencies to continue to have access to the usual home addresses referenced the existing (although not ideal) permissions embedded within the Representation of the People Act and the Supplementary Regulation thereto which permit the credit reference agencies to access the full electoral register for certain specified purposes and also to provide it to others that are authorised users but who may not want to process it for themselves.
There are however a number of shortcomings in the provisions of the Representation of the People Act which have resulted in an anomaly whereby lenders may use the data to perform checks at the outset of a credit agreement but may not use the data thereafter to manage the agreement. Some of the issues have been addressed in these regulations but there are some other changes that we would recommend.
The Recommendations
The following text has been taken form the draft with the recommended changes marked, a summary of the suggested changes, with reasons follows this section
PART 2
Disclosure to a credit reference agency
2. The conditions specified for the disclosure of protected information by the registrar to a credit
reference agency are that—
(a) the credit reference agency is carrying on in the United Kingdom or in another EEA State
a business comprising the furnishing of information relevant to the financial standing of
individuals or businesses, being information collected by the agency for that purpose;
(b) the credit reference agency intends to take delivery of and to use the protected
information only in the United Kingdom or in another EEA State;
(c) the credit reference agency has in place and maintains appropriate procedures—
(i) to ensure that an independent person can investigate and audit the measures
maintained by the agency for the purposes of ensuring the security of any protected
information disclosed to that agency; and
(ii) for the purposes of ensuring that it complies with its obligations under the Data
Protection Act 1998(a), or, where the agency carries on business in a EEA State
other than the United Kingdom, with its obligations under Directive 95/46/EC of the
European Parliament and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and on the free movement
of such data (b);
(d) the credit reference agency intends to use and/or supply that information to clients only for the purposes of—
(i) providing an assessment of the credit worthiness of a person; or
(ii) meeting any obligations contained in the Money Laundering Regulations 2007(a) or
any rules made pursuant to section 146 of the Financial Services and Markets Act
2000(b) (money laundering rules), or in any legislation of another EEA State
implementing Directive 2005/60/EC of the European Parliament and of the Council
of 26th October 2005 on the prevention of the use of the financial system for the
purpose of money laundering and terrorist financing(c);
(iii) conducting conflict of interest checks required by any enactment; or
(iv) the provision of protected information to a public authority specified in Schedule 1
to these Regulations which, in the opinion of the registrar of companies, satisfies the
requirements of paragraph 1 of this Schedule, or.
(iiv) conducting checks for the prevention and detection of crime or fraud, or
(iiiv) where they are required or permitted by Statute, or
(ix) with the freely given explicit and informed consent of the data subject
(x) for statistical analysis where no individual can be identified
(e) the credit reference agency has not been found guilty of an offence under—
(i) section 1112 (general false statement offence) of the Act or section 2 of the Fraud
Act 2006(d) (fraud by false representation); or
(ii) section 47 (failure to comply with enforcement notice) of the Data Protection Act
1998 for failing to use the protected information in accordance with sub-paragraph
(d) above;
(f) the recipient of the information (“the recipient”) will, where he supplies a copy of that
information to a processor for the purpose of processing the information for use in respect
of the purposes for which the recipient is entitled to obtain such information, ensure
that—
(i) the processor is one who carries on business in the European Economic Area;
(ii) the information is not transmitted outside the European Economic Area by the
processor; and
(iii) the processor does not disclose the information except to the recipient or an
employee of the recipient; and
(g) the credit reference agency has delivered to the registrar a statement that it meets the
conditions in sub-paragraphs (a) to (f) above.
The suggested changes
2 (a) The addition of “or businesses” in the definition of a credit reference agency will include those credit reference agencies that hold information for the purposes of assessing businesses. Without this addition, only 2 of the 5 commercial data credit reference agencies will be able to use this data.
2 (d) The addition of the words “and/or supply” and “to clients” such that the section states: the credit reference agency intends to use and/or supply that information to clients only for the purposes of— is required because credit reference agencies supply information to lenders so that they can perform checks. In many cases the output is fully automated and the lender may only get a score but in some cases the lender will need to verify what a data subject who is a proprietor has said so they will need access to the data.
2 (d) (iiv) conducting checks for the prevention and detection of crime or fraud, or – the current checks covered in section (ii) are to restricted to cover all that will be required. Not all fraud and crime is covered by Money Laundering or FSMA.
2 (d) (iiiv) where they are required or permitted by Statute, or – there are occasions when we are required to provide data such as under a court order, the Social Security Fraud Act or under the Data Protection Act sections, 28, 29 or 35 when credit reference agencies may be required or asked to provide such data
2 (d) (ix) with the freely given explicit and informed consent of the data subject – on many occasions access to the data is required to verify information provided by the data subject themselves
2 (d) (x) for statistical analysis where no individual can be identified – from time to time and for the development of systems organisations perform statistical analysis wherein the data is anonymised.
Other issues
The Companies Act 2006 also made provision for similar controls and protections for shareholders data. Notwithstanding the fact that regulations have been laid removing the necessity for companies to register all shareholders there are still requirements that any beneficial shareholder with 10% or more equity should be registered at Companies House,
Under the Prevention of Money Laundering Regulations lenders are required to undertake checks for the prevention of money laundering on any beneficial shareholder with 25% or more equity in a company – whether or not they be a director.
So far there has been no suggestion that the shareholders’ register will be made available on a similar basis to the directors’ data and this issue needs to be addressed without delay.
Version 1.0
[1] There are currently c 200,000 companies registered as credit reference agencies and licensed under the Consumer Credit Act. Most do not operate any form of operation for the support of credit decisioning but 5 do supply similar services for corporate activities. There are currently just 3 agencies in the UK that operate and supply consumer data for credit referencing purposes, 2 of which also supply commercial data.
[2] For the purposes of this paper a business is used to refer to a commercial organisation of any structure from a sole trade to a publicly quoted company.
[3] A proprietor is used to refer to the “owner” or owners such as partner, directors or proprietors such as in the case of a sole trader.